<!DOCTYPE html
  PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
  "DTD/xhtml1-strict.dtd">
<html>
  <head>
    <title>volatility.plugins.malware.apihooks.Hook : API documentation</title>
    <meta content="text/html;charset=utf-8" http-equiv="Content-Type" />
    <link href="apidocs.css" type="text/css" rel="stylesheet" />
    
    
  </head>
  <body>
    <h1 class="class">v.p.m.a.Hook(<span title="object">object</span>) : class documentation</h1>
    <p>
      <span id="part">Part of <a href="volatility.html">volatility</a>.<a href="volatility.plugins.html">plugins</a>.<a href="volatility.plugins.malware.html">malware</a>.<a href="volatility.plugins.malware.apihooks.html">apihooks</a></span>
      
      <a href="classIndex.html#volatility.plugins.malware.apihooks.Hook">View In Hierarchy</a>
    </p>
    <div>
      
    </div>
    <div>A class for API hooks. It helps organize the many
pieces of information required to report on the hook.<table class="fieldTable"></table></div>

    
    
    <div id="splitTables">
      <table class="children sortable" id="id85">
  
  
<tr class="method">
    
    
    <td>Method</td>
    <td><a href="volatility.plugins.malware.apihooks.Hook.html#__init__">__init__</a></td>
    <td><span>Initalize a hook class instance.</span></td>
  </tr><tr class="method">
    
    
    <td>Method</td>
    <td><a href="volatility.plugins.malware.apihooks.Hook.html#add_hop_chunk">add_hop_chunk</a></td>
    <td><span>Support disassembly for multiple hops</span></td>
  </tr><tr class="method">
    
    
    <td>Method</td>
    <td><a href="volatility.plugins.malware.apihooks.Hook.html#Type">Type</a></td>
    <td><span>Translate the hook type into a string</span></td>
  </tr><tr class="method">
    
    
    <td>Method</td>
    <td><a href="volatility.plugins.malware.apihooks.Hook.html#Mode">Mode</a></td>
    <td><span>Translate the hook mode into a string</span></td>
  </tr><tr class="method">
    
    
    <td>Method</td>
    <td><a href="volatility.plugins.malware.apihooks.Hook.html#Function">Function</a></td>
    <td><span>Return the function name if its available</span></td>
  </tr><tr class="method">
    
    
    <td>Method</td>
    <td><a href="volatility.plugins.malware.apihooks.Hook.html#Detail">Detail</a></td>
    <td><span>The detail depends on the hook type</span></td>
  </tr><tr class="method">
    
    
    <td>Method</td>
    <td><a href="volatility.plugins.malware.apihooks.Hook.html#HookModule">HookModule</a></td>
    <td><span>Name of the hooking module</span></td>
  </tr><tr class="method">
    
    
    <td>Method</td>
    <td><a href="volatility.plugins.malware.apihooks.Hook.html#VictimModule">VictimModule</a></td>
    <td><span>Name of the victim module</span></td>
  </tr><tr class="method private">
    
    
    <td>Method</td>
    <td><a href="volatility.plugins.malware.apihooks.Hook.html#_module_name">_module_name</a></td>
    <td><span>Return a sanitized module name</span></td>
  </tr>
  
</table>
      
      
    </div>
    
    
    

    <div class="function">
  <a name="volatility.plugins.malware.apihooks.Hook.__init__">
    
  </a>
  <a name="__init__">
    
  </a>
  <div class="functionHeader">
    
    def
    __init__(self, hook_type, hook_mode, function_name, function_address=None, hook_address=None, hook_module=None, victim_module=None):
    
  </div>
  <div class="functionBody">
    
    <div><p>Initalize a hook class instance.</p>
<p>&#64;params hook_type: one of the HOOK_TYPE_* constants
&#64;params hook_mode: one of the HOOK_MODE_* constants</p>
<p>&#64;params function_name: name of the function being hooked</p>
<dl class="rst-docutils">
<dt>&#64;params function_address: address of the hooked function in</dt>
<dd>process or kernel memory.</dd>
<dt>&#64;params hook_address: address where the hooked function</dt>
<dd>actually points.</dd>
<dt>&#64;params hook_module: the _LDR_DATA_TABLE_ENTRY of the</dt>
<dd>hooking module (owner of the hook_address). note:
this can be None if the module cannot be identified.</dd>
<dt>&#64;params victim_module: the _LDR_DATA_TABLE_ENTRY of the</dt>
<dd>module being hooked (contains the function_address).
note: this can be a string if checking IAT hooks.</dd>
</dl><table class="fieldTable"></table></div>
  </div>
</div><div class="function">
  <a name="volatility.plugins.malware.apihooks.Hook.add_hop_chunk">
    
  </a>
  <a name="add_hop_chunk">
    
  </a>
  <div class="functionHeader">
    
    def
    add_hop_chunk(self, address, data):
    
  </div>
  <div class="functionBody">
    
    <div>Support disassembly for multiple hops<table class="fieldTable"></table></div>
  </div>
</div><div class="function">
  <a name="volatility.plugins.malware.apihooks.Hook._module_name">
    
  </a>
  <a name="_module_name">
    
  </a>
  <div class="functionHeader">
    
    def
    _module_name(self, module):
    
  </div>
  <div class="functionBody">
    
    <div>Return a sanitized module name<table class="fieldTable"></table></div>
  </div>
</div><div class="function">
  <a name="volatility.plugins.malware.apihooks.Hook.Type">
    
  </a>
  <a name="Type">
    
  </a>
  <div class="functionHeader">
    @property<br />
    def
    Type(self):
    
  </div>
  <div class="functionBody">
    
    <div>Translate the hook type into a string<table class="fieldTable"></table></div>
  </div>
</div><div class="function">
  <a name="volatility.plugins.malware.apihooks.Hook.Mode">
    
  </a>
  <a name="Mode">
    
  </a>
  <div class="functionHeader">
    @property<br />
    def
    Mode(self):
    
  </div>
  <div class="functionBody">
    
    <div>Translate the hook mode into a string<table class="fieldTable"></table></div>
  </div>
</div><div class="function">
  <a name="volatility.plugins.malware.apihooks.Hook.Function">
    
  </a>
  <a name="Function">
    
  </a>
  <div class="functionHeader">
    @property<br />
    def
    Function(self):
    
  </div>
  <div class="functionBody">
    
    <div>Return the function name if its available<table class="fieldTable"></table></div>
  </div>
</div><div class="function">
  <a name="volatility.plugins.malware.apihooks.Hook.Detail">
    
  </a>
  <a name="Detail">
    
  </a>
  <div class="functionHeader">
    @property<br />
    def
    Detail(self):
    
  </div>
  <div class="functionBody">
    
    <div>The detail depends on the hook type<table class="fieldTable"></table></div>
  </div>
</div><div class="function">
  <a name="volatility.plugins.malware.apihooks.Hook.HookModule">
    
  </a>
  <a name="HookModule">
    
  </a>
  <div class="functionHeader">
    @property<br />
    def
    HookModule(self):
    
  </div>
  <div class="functionBody">
    
    <div>Name of the hooking module<table class="fieldTable"></table></div>
  </div>
</div><div class="function">
  <a name="volatility.plugins.malware.apihooks.Hook.VictimModule">
    
  </a>
  <a name="VictimModule">
    
  </a>
  <div class="functionHeader">
    @property<br />
    def
    VictimModule(self):
    
  </div>
  <div class="functionBody">
    
    <div>Name of the victim module<table class="fieldTable"></table></div>
  </div>
</div>
    <address>
      <a href="index.html">API Documentation</a> for Volatility 2.2, generated by <a href="http://codespeak.net/~mwh/pydoctor/">pydoctor</a> at 2013-06-24 15:16:10.
    </address>
  </body>
</html>